VAPT and penetration testing blog
Plain-language articles for the Indian teams who commission, run and fix the results of VAPT and penetration tests.
Budgets and audits
Start here if a regulator, an auditor or a finance team is asking questions.
How much does VAPT cost in India?
Published 2026 rupee ranges by test type, what moves a quote, how GST applies and the signs of a scan sold as a pentest.
Read articleCERT-In empanelled audits and the 2025 guidelines
Who the July 2025 audit policy covers, the audit types it lists and how to get ready with pre-audit VAPT.
Read articleBefore you sign a VAPT proposal
Decide what goes in scope, how much your testers should know, how long to allow and how often to repeat.
Scoping a VAPT
Turn a one-line request into a list of targets, roles, windows and limits that a tester can price accurately.
Read articleBlack, grey or white box?
What each level of information gives your testers, and why grey box tends to find most per rupee.
Read articleHow long does VAPT take?
Testing days by target type, plus the scoping, reporting and retest time that surrounds them.
Read articleHow often should you run VAPT?
Annual, half-yearly, per release or continuous, set against your release pace and Indian rules.
Read articleVAPT or bug bounty?
Which model gives you audit evidence, which adds outside eyes, and how to run them side by side.
Read articleVAPT RFP questions
What to ask bidders about method, manual effort, GST, retests and any empanelment claim.
Read articleFor IT and engineering teams
Where testers look first in two targets that appear in most Indian VAPT scopes.
Turn findings into closure
Read the severity correctly, fix what matters and keep the evidence your auditor will ask for.
Ready to find your risks before attackers do?
Tell us what you need tested or monitored. A senior consultant replies within one business day with a scoped, fixed-price proposal.
- Fixed-price proposal
- Reply within 1 business day
- NDA on request